Privacy Policy

This policy explains how Yakware ("we", "us") handles personal data in connection with SocialYak. SocialYak plays two distinct roles, and this policy covers both:

• Yakware as controller — for data about you: your account, billing, and your visits to our own websites.
• Yakware as processor — for the content you schedule and publish and the social accounts you connect. For that data, you are the controller.

1. Data we collect as controller

Account data

When you register we collect your email address, a password (stored only as a salted hash), and optionally an account or display name. We use this data to operate your account, secure it, and send you service emails (verification, password reset, important service notices).

Billing data

Payments are processed by Stripe. We receive and store your subscription status and a Stripe customer reference — never your card number. Stripe's handling of your payment details is described in Stripe's own privacy policy.

Our websites

Our marketing and application pages set only the cookies strictly necessary to operate the site (see the Cookie Policy). We do not run advertising or third-party analytics trackers on our own sites.

Browser extension

The SocialYak browser extension stores an access key for your workspace in your browser, which you can revoke at any time under Settings → Developer. It sends us the address and title of your current tab only when you open the extension or its side panel, and text only when you select it and choose a SocialYak action. We use this solely to draft posts, shorten links, save sources, show your own post and profile statistics, and suggest replies. The extension does not read feeds or posts on social networks, does not act on them for you, and contains no advertising or analytics. We do not sell this data or use it for any other purpose.

2. Data we process on your behalf

To provide the Service, we process the following on your instructions:

• Connected accounts — the social profiles you (or your clients) link, and the access tokens returned by those networks. Tokens are stored encrypted and are decrypted only to publish your content and retrieve your analytics.
• Content and media — the posts, drafts, media, comments, and schedules you create, together with the engagement and analytics data the networks return about your published content.
• Client review data — when you invite a client to connect an account or approve posts through a login-free link, we process the minimal data needed to identify that link and record the decision.

As the controller for this data, you are responsible for having a lawful basis for the personal data in the content you publish and for the accounts you connect. We do not use your content or analytics for our own purposes, and we do not sell it.

3. Third-party networks

When you connect a social network (for example X, Instagram, Facebook, LinkedIn, TikTok, YouTube, Threads, or Pinterest), that network's own privacy terms govern how it handles the data you send it and the audience who sees your posts. We interact with each network only through its official API, using the access you granted, and only to provide the Service to you.

YouTube API Services

SocialYak uses YouTube API Services to upload videos to YouTube channels you connect. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

• What we access. When you connect, we read your channel's ID and title. When you publish, we upload the video you chose with the title, description, visibility, audience and altered-content settings you picked, then read that video's upload and processing status. We do not read your subscribers, comments, analytics, or other videos.
• How we use and store it. Only to publish what you schedule and to show you whether it worked. Access tokens are stored encrypted. Your channel ID and title, and the receipts for videos we uploaded (video ID and status), are kept while the connection exists. We re-check them with YouTube at least every 30 days and delete them if they can no longer be confirmed.
• Sharing. We do not sell YouTube data, use it for advertising, or use it to train AI models. It is shared only with the hosting provider listed below, to run the Service.
• Cookies. SocialYak's own cookies are described in our Cookie Policy. We do not place cookies on behalf of YouTube.
• Revoking access. Remove the channel under Connections: we revoke Google's grant immediately and delete that channel's YouTube data. You can also revoke SocialYak at any time from Google's security settings; we then delete the channel's YouTube data within 30 days.
• Questions or complaints about our use of YouTube data: support@yakware.com.

SocialYak's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. No person at Yakware reads your YouTube data unless you ask us to for support, it is needed for security or to comply with the law.

Pinterest availability and information

Pinterest connections and publishing are currently unavailable while access is under review. We do not offer Pinterest analytics, content importing, advertising, competitor benchmarking or automated engagement. We do not use Pinterest API information to train AI models or generate content. We will describe the approved processing and retention here before opening access.

4. Subprocessors and hosting

We use a small number of service providers to operate SocialYak:

• Hetzner — cloud infrastructure hosting the Service and its data.
• Stripe — payment processing.

We will update this list before adding subprocessors that handle personal data.

5. Retention

Account data is retained while your account exists and deleted within 90 days of account deletion, except where law requires longer retention (for example, invoicing records). Your content, schedules, and connected-account tokens are retained while your account is active; you may disconnect an account or delete content at any time, and removing a connection deletes its stored tokens from the active database. To revoke the provider’s grant itself, use that network’s app-access settings; for YouTube, removing the connection also revokes Google’s grant.

6. Your rights

Depending on your jurisdiction (for example, under the GDPR), you may have the right to access, correct, export, restrict, or delete your personal data, and to object to processing. Contact us at the address below to exercise these rights; we respond within 30 days. If your request concerns content one of our customers publishes through their account, we will refer you to that customer, who controls the data.

7. Legal bases

Where the GDPR applies, we process account and billing data to perform our contract with you, service emails on the basis of legitimate interest in operating the Service, and data processed on your behalf under your instructions as processor.

8. Security

Data is encrypted in transit. Connected-account tokens are encrypted at rest. Access to production systems is restricted to authorized personnel. Passwords are stored as salted hashes; payment card data never touches our servers.

9. Children

The Service is not directed at children under 16, and we do not knowingly collect their data.

10. Changes

We will post changes to this policy here and, for material changes, notify you by email or in the Service before they take effect.

SMS / mobile messaging

If you enable SMS verification, we use your mobile number only to send one-time verification codes and account/security notifications. We do not sell, rent, or share your mobile number or SMS opt-in with third parties or affiliates for their marketing. Message frequency varies. Message and data rates may apply. Reply STOP to cancel, HELP for help.

11. Contact

Privacy questions and data-subject requests: support@yakware.com.